Splunk Search

problem with addcoltotals

abhayneilam
Contributor

Hi,

I have a file like :

XXXX 20
YYYY 40
ZZZZ 60

I am running a query ....|addcoltotals

I am getting :
XXXX 20
YYYY 40
ZZZZ 60
120

but I also want to mention Grand_Total in the first field as I want my output like :

XXXX 20
YYYY 40
ZZZZ 60
Total 120

"Total" String should come...

Please help !!

Thanks in Advance

0 Karma
1 Solution

jonuwz
Influencer

An example :

 * | stats count by sourcetype | addcoltotals labelfield=sourcetype label="Total"

labelfield is the column you want the label to appear in

label is the text in the labelfield.

View solution in original post

tmnteam
Engager

Hello,

I have a search with a "stats [...] by _time" at the end. (with a bin span=hour)

I have tried with labelfield=_time but it doesn't work (value is 0NaN-NaN-NaN NaN:NaN:NaN)

Is it possible to remap this label?

Thank you in advance.

0 Karma

somesoni2
Revered Legend

Since _time is in the epoch format (after your query) and with addtotal, you're trying to add a row with _time="Total" (not a valid date format).

0 Karma

jonuwz
Influencer

An example :

 * | stats count by sourcetype | addcoltotals labelfield=sourcetype label="Total"

labelfield is the column you want the label to appear in

label is the text in the labelfield.

Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...